machine-bridge-mcp 3.0.0-beta.185 → 3.0.0-beta.190

package/CHANGELOG.md

@@ -1,11 +1,10 @@
 # Changelog
 
-## 3.0.0-beta.185 - 2026-09-11
+## 3.0.0-beta.190 - 2026-09-13
 
-- Preserve interrupted workspace-profile migration after a source-profile rename when Windows exposes the same state root through a different long/short or junction-equivalent path: relocated historical proof canonicalizes only the nearest existing ancestor, still requires the exact historical profile hash plus `state.json` suffix, and rejects a different canonical ancestor.
-- Normalize Windows native-path identity during workspace migration so active locks and relocated historical profile state remain comparable across ordinary drive paths and native namespace-prefixed forms without weakening containment checks.
-- Keep hosted validation compatible with CodeQL by replacing dynamic resolver regular-expression construction with fixed token parsing while retaining the same release-carrier and worktree-selection behavior.
-- Invalidate the stale beta.184 acceptance after the packaged migration repair and advance package, Worker, and browser-extension identity to `3.0.0-beta.185`; fresh activation, deployed OAuth canary evidence, and observed live verification are required before recording acceptance.
+- Reuse generation-bound V8 coverage collected during the authoritative full verification plan so the coverage gate only executes fixtures whose evidence is still missing; standalone coverage verification remains self-contained.
+- Make GitHub release publication consume exact-main provider CI instead of repeating a local dependency install and full verification after merge, while retaining synchronized-version checks, accepted-candidate byte and promotion-digest revalidation, exact-main revalidation before remote mutation, and uploaded-asset digest verification.
+- Increase only the Windows runtime self-test success-fixture budget for loaded hosted CI; production process and resource-admission deadlines remain unchanged.
 
 ## Historical releases
 

package/browser-extension/manifest.json

@@ -30,6 +30,6 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "3.0.0-beta.185",
+  "version_name": "3.0.0-beta.190",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxryYkpZhq8+VAQLHcGS9BAHQcyKX8RHGIpIwvtIVRU/rcOcE0bNdnM0aZJ/h6xWQsGDHlhvjT2+1aJaAn/9k8473BRWajzVXld961CdHYVFVHoce2hHiSJ0xydWrHMMZhAm0mN0UzjEpgZ0tMw209efcZHIvSwuxhteZMRy4kyiVjwFlOf5oXFCxRuCJnPj3AK9CmCf4XgEBuPIJ0TZmjGHOOdBvJmbCNnAWXYEo5/mf7MfCGhV4IJ1hNuhpoNQfOFKMUcw9/v/IpT62XpfXdGYTfGYCmCjC+gntK1spbkr2P4/2+sYMQtLpse71mpSNGXfcf3abU55Vpn+gncSxRQIDAQAB"
 }

package/docs/AUDIT.md

@@ -26,9 +26,10 @@ This file is the current audit summary. Historical findings, closed incidents, a
 - Beta.181 supersedes the activated-but-unaccepted beta.180 candidate after live owner-machine routing exposed two semantic classification defects rather than a relay failure: `非交互工作` and conditional `外部输入或授权` wording could exclude task supervision, while a project token could weak-match an unrelated installed application sharing one lexical fragment. The repair narrows interactive intent to explicit process/input contexts, requires lexical-token evidence for partial application matches, and makes an already-positive task-supervisor continuation contract authoritative for primary route selection. beta.180 relay standby/takeover behavior is unchanged.
 - Beta.182 is the reviewed predecessor candidate that added repository-specific durable routing for known long prerelease commands, extracted reconnect result settlement into a focused policy module while retaining the then-existing per-tool settlement ceiling, and recorded the controlled relay A/B. Its packaged bytes remain associated with beta.182 and are not reused after the independent re-review changed shipped source.
 - Beta.183 supersedes beta.182 after that re-review found package-affecting continuity, routing, privacy, and auditability defects. Repository-specific long workflows now request durable task supervision through project-provided registered-command metadata rather than hard-coded script names in generic routing; explicit read-only/negated/hypothetical/interactive/existing-job wording is kept out of new-job creation, and weak application-name matches require UI-operation intent. Worker reconnect settlement keeps execution/redelivery on the original deadline but grants the verified same-daemon terminal-result owner one fixed non-cumulative 15-second delivery-only extension beyond the original settlement deadline. Managed-job output redaction is byte-first and truncation-boundary safe; saturated retention tolerates a stale active-to-terminal dependency-plan deletion race without weakening genuine active-state fail-closed behavior; multiline static module edges are included in the architecture graph; and public worktree resolution no longer depends on maintainer-home tooling. The beta.182 controlled application-proxy A/B remains evidence only for the induced fault branch and does not identify the cause of spontaneous historical 1006 resets.
+- Beta.186 is the source candidate produced by an independent beta.185 review. The first review confirmed two issues: a zero-wait `read_job` starts with exactly the 10-second managed-read headroom, so any positive reconnect delay made daemon-proven non-delivery ineligible for redelivery; and the output-redaction sink itself accepted an empty literal even though current resource materialization already filters empty patterns. Subsequent hardening reproduced four adjacent boundary defects before acceptance: truncation-tail protection could receive truthy non-string redaction entries; repeated missing acknowledgements could re-enter redelivery policy; `resume_calls_ack.missing_ids` was not bound to the exact resume set emitted on that connection; and shorter protected bytes/paths/literals could partially replace a longer overlapping value and leave its suffix visible. The candidate now uses one literal-pattern filter, processes overlapping protected values longest-first, binds resume acknowledgement to the exact connection-scoped resume set, consumes one semantic acknowledgement while treating only its exact duplicate as idempotent, and records the channel of the one successful same-ID transport redelivery. A different later acknowledgement or out-of-set ID is a protocol error, while a later reconnect that again proves non-delivery returns the existing retryable no-side-effect failure. Low-headroom `read_job` redelivery still becomes `wait_ms: 0`, preserves the original execution deadline, and refuses less than one second of execution budget; fresh dispatch still requires the ordinary 10-second reconciliation headroom. The existing socket protocol-error counter is now driven by real WebSocket and signed-HTTPS ready-channel rejection paths without recording daemon payload values. Here “production protocol rejection paths” means the shipped Worker handler paths that can serve production traffic; it is a source-path reachability claim, not evidence that beta.186 has been deployed to or observed in a production environment. Other report proposals are not treated as defects without stronger evidence: request-stream closure is deliberately cancellation for request-scoped work; the 2-second durable-process initial settlement window is a response-coalescing bound rather than task lifetime and same-response `read_job` continuation remains the orchestration contract; historical macOS relocation already canonicalizes existing realpath ancestors, so platform-wide lowercasing would be unsound on case-sensitive volumes; beta.179 and beta.181 have passed acceptance records and are retained; and disabling fallback-proxy keep-alive is not justified by the current fault-injection evidence alone.
 
 ## Residual review requirements
 
 A green fast or full suite is necessary but not sufficient security evidence for publication. Release acceptance still requires the package/install/security gates and any hosted or live boundary evidence required by the changed surface. This summary does not authorize deployment or npm publication.
 
-Beta.181 is the current accepted/live baseline. Beta.182 remains the reviewed but superseded predecessor candidate. Beta.183 is the unaccepted replacement candidate and must pass frozen-tree verification plus exact-candidate owner-machine activation before acceptance. The controlled application-proxy A/B establishes only the induced fault branch; the spontaneous historical upstream reset source remains unassigned within the current privacy-bounded evidence. A future relay reset may still occur; continuity success means bounded warm HTTPS takeover plus durable task ownership, not an impossible no-disconnect guarantee. npm publication remains separately gated.
+Beta.185 is the latest repository acceptance record and remains the accepted prior-byte baseline. Beta.186 is a new local source candidate and must not inherit beta.185 acceptance: frozen-tree verification, packaging/install/security checks, and any exact-candidate live activation evidence required by the changed surface must be produced again before acceptance. The spontaneous historical upstream reset source remains unassigned within the current privacy-bounded evidence; a future relay reset may still occur. npm publication remains separately gated.

package/docs/LOGGING.md

@@ -156,7 +156,7 @@ Each managed job has owner-only runner diagnostic logs. Child-step output is ret
 
 `network_route` describes only Machine Bridge's application-level proxy decision. `system-network-stack` does **not** mean a direct physical path: an operating-system VPN, TUN, packet tunnel, DNS interceptor, or endpoint-security product may still carry the connection. `network_route_scope` therefore remains `application-proxy-selection-only`.
 
-During an outage, remote-owner `diagnose_runtime.runtime.relay` and local stdio `server_info.runtime.relay` expose bounded live fields: outage count/start/duration, attempts, last close category/code, coarse transport error class plus strict allowlisted `last_transport_error_reason`, last disconnect/ready time, prior ready duration, prior ready inbound-silence duration, the thirty-second WSS connect budget, bounded `last_connect_milestones_ms`, transport-probe queue/dispatch/Pong state, second-stage transport-confirmation timing/recovery state, bounded sender backlog bytes, HTTPS fallback active/warming state, `https_fallback_last_takeover_ms`, and next retry timing. `https_fallback_last_takeover_ms` retains the bounded WSS-close-to-verified-HTTPS-ready interval even after WSS later reclaims primary ownership, so a longer WebSocket outage is not misreported as the same duration of whole-bridge unavailability when HTTPS recovered earlier. The fallback status separates `last_success_at` (any successful signed HTTP exchange, including standby) from `last_ready_at` (only verified ready ownership), so a successful standby poll can no longer be misread as a completed failover. Connect milestones are relative durations only and never include hostnames, addresses, DNS answers, certificates, proxy endpoints, or credentials. The current-attempt milestones and separate `last_failed_connect_*` fields are retained independently so a successful retry cannot erase the immediately preceding failed DNS/TCP/TLS/upgrade evidence; `last_transport_error_ready` and `last_transport_error_authenticated` state whether the retained transport error occurred after channel authentication/readiness. Worker-side `daemon.websocket.closed` records only a bounded close code plus `was_clean`; raw peer close reasons are deliberately omitted. An already-dispatched Worker call detached from a failed channel is retained only until the smaller of reconnect grace and that call's original remaining absolute deadline. If it settles without rebinding, the public bounded error distinguishes `original call deadline expired during reconnect` from a true full `reconnect grace expired`; neither diagnostic includes tool arguments, paths, account identity, endpoint data, or result content, and the distinction does not extend the hosted deadline. Resource-coordinator snapshot contention is likewise classified separately from execution failure: when the bounded diagnostic cannot acquire a transaction/staging lock, it reports retryable `unavailable`, `reason=coordinator_busy`, and `snapshot_available=false`. This says the diagnostic snapshot was unavailable under contention; it does not relax admission policy or claim that the underlying host pressure is Green. `outage_duration_ms` is the close-to-ready recovery interval; `last_ready_inbound_silence_ms` is the pre-close interval since the preceding ready transport last proved inbound activity. After recovery, authenticated remote `server_info.daemon.relay_transport` retains the bounded preceding episode supplied during the current connection handshake, including `previous_ready_inbound_silence_ms` and brief interruptions below the default warning threshold. Promotion to a ready socket sets `outage_active=false`, extends the outage duration through actual readiness, preserves the preceding healthy-ready duration and inbound-silence evidence across failed candidates, canonicalizes timestamps, and accepts only enumerated coarse operational error classes; it does not claim that the recovered connection remains in outage. The `local_authority_revocation_retry` category is deliberately not diagnosed as a network failure: a sustained warning directs the operator to local authority, process-session, and managed-job state while the retained Worker revocation retries on reconnection; ordinary transport categories retain network/Worker troubleshooting guidance. On macOS, `diagnose_runtime` may also return a coarse default-route class, `operating_system_interception` boolean, privacy-bounded `runtime.idle_sleep_guard` state (`supported`, `enabled`, `active`, `grace_ms`, `requests_system_sleep_prevention_on_ac`, `last_error_class`), bounded `runtime.system_sleep`, and `runtime.relay_outage_analysis`. The sleep correlation distinguishes direct close-to-ready overlap from `wake_boundary_system_sleep_aftermath`, which requires the same sleep interval to match both the observed wake-adjacent disconnect and the daemon event-loop stall end/duration; a socket close cannot necessarily be observed while JavaScript is suspended. A near-wake reset without that independent stall match remains unassigned. That diagnostic is returned on demand and is not promoted to default logs; interface names, IP addresses, DNS answers, proxy endpoints/credentials, Worker endpoints, tool arguments, and results remain absent. `relay.outage.active` and `relay.outage.recovered` carry the existing safe relay fields.
+During an outage, remote-owner `diagnose_runtime.runtime.relay` and local stdio `server_info.runtime.relay` expose bounded live fields: outage count/start/duration, attempts, last close category/code, coarse transport error class plus strict allowlisted `last_transport_error_reason`, last disconnect/ready time, prior ready duration, prior ready inbound-silence duration, the thirty-second WSS connect budget, bounded `last_connect_milestones_ms`, transport-probe queue/dispatch/Pong state, second-stage transport-confirmation timing/recovery state, bounded sender backlog bytes, HTTPS fallback active/warming state, `https_fallback_last_takeover_ms`, `https_fallback_last_takeover_outage_number`, and next retry timing. `https_fallback_last_takeover_ms` retains the bounded WSS-close-to-verified-HTTPS-ready interval even after WSS later reclaims primary ownership, so a longer WebSocket outage is not misreported as the same duration of whole-bridge unavailability when HTTPS recovered earlier; `https_fallback_last_takeover_outage_number` binds that takeover to the exact WebSocket outage episode. The fallback status separates `last_success_at` (any successful signed HTTP exchange, including standby) from `last_ready_at` (only verified ready ownership), so a successful standby poll can no longer be misread as a completed failover. In addition, each completed episode in `recent_outages` independently records `https_fallback_taken_over` and bounded `https_fallback_takeover_ms` keyed to that outage number, ensuring prior takeovers or intervening no-takeover episodes are not conflated. Connect milestones are relative durations only and never include hostnames, addresses, DNS answers, certificates, proxy endpoints, or credentials. The current-attempt milestones and separate `last_failed_connect_*` fields are retained independently so a successful retry cannot erase the immediately preceding failed DNS/TCP/TLS/upgrade evidence; `last_transport_error_ready` and `last_transport_error_authenticated` state whether the retained transport error occurred after channel authentication/readiness. Worker-side `daemon.websocket.closed` records only a bounded close code plus `was_clean`; raw peer close reasons are deliberately omitted. An already-dispatched Worker call detached from a failed channel is retained only until the smaller of reconnect grace and that call's original remaining absolute deadline. If it settles without rebinding, the public bounded error distinguishes `original call deadline expired during reconnect` from a true full `reconnect grace expired`; neither diagnostic includes tool arguments, paths, account identity, endpoint data, or result content, and the distinction does not extend the hosted deadline. Resource-coordinator snapshot contention is likewise classified separately from execution failure: when the bounded diagnostic cannot acquire a transaction/staging lock, it reports retryable `unavailable`, `reason=coordinator_busy`, and `snapshot_available=false`. This says the diagnostic snapshot was unavailable under contention; it does not relax admission policy or claim that the underlying host pressure is Green. `outage_duration_ms` is the close-to-ready recovery interval; `last_ready_inbound_silence_ms` is the pre-close interval since the preceding ready transport last proved inbound activity. After recovery, authenticated remote `server_info.daemon.relay_transport` retains the bounded preceding episode supplied during the current connection handshake, including `previous_ready_inbound_silence_ms` and brief interruptions below the default warning threshold. Promotion to a ready socket sets `outage_active=false`, extends the outage duration through actual readiness, preserves the preceding healthy-ready duration and inbound-silence evidence across failed candidates, canonicalizes timestamps, and accepts only enumerated coarse operational error classes; it does not claim that the recovered connection remains in outage. The `local_authority_revocation_retry` category is deliberately not diagnosed as a network failure: a sustained warning directs the operator to local authority, process-session, and managed-job state while the retained Worker revocation retries on reconnection; ordinary transport categories retain network/Worker troubleshooting guidance. On macOS, `diagnose_runtime` may also return a coarse default-route class, `operating_system_interception` boolean, privacy-bounded `runtime.idle_sleep_guard` state (`supported`, `enabled`, `active`, `grace_ms`, `requests_system_sleep_prevention_on_ac`, `last_error_class`), bounded `runtime.system_sleep`, and `runtime.relay_outage_analysis`. The sleep correlation distinguishes direct close-to-ready overlap from `wake_boundary_system_sleep_aftermath`, which requires the same sleep interval to match both the observed wake-adjacent disconnect and the daemon event-loop stall end/duration; a socket close cannot necessarily be observed while JavaScript is suspended. A near-wake reset without that independent stall match remains unassigned. That diagnostic is returned on demand and is not promoted to default logs; interface names, IP addresses, DNS answers, proxy endpoints/credentials, Worker endpoints, tool arguments, and results remain absent. `relay.outage.active` and `relay.outage.recovered` carry the existing safe relay fields.
 
 Schema 4 is strict NDJSON. Before daemon startup, both active log files are opened as owner-only regular single-link files. A schema change clears both only after validation and commits the marker only after the transition succeeds. A symlink, multiple-hard-link inode, permission error, or marker-write failure blocks startup rather than mixing formats or repeatedly erasing evidence.
 

package/docs/OPERATIONS.md

@@ -10,7 +10,7 @@ machine-mcp service status
 
 Routine remote checks should use authenticated `server_info` with `detail: "summary"`; request the default/full projection only when the caller's authority permits and exact effective-tool, OAuth/account, or detailed owner observability is actually needed. Non-owner full responses intentionally retain hidden markers/counts instead of cross-principal activity, resource aliases, stable device-key identity, or daemon-only tool names. Remote `diagnose_runtime` is owner-only because its fixed probes expose machine-wide control-plane activity; narrower roles use `server_info`/`project_overview` for authority-scoped readiness and workspace state. `status` prints redacted profile state and verifies the deployed Worker version. Resource source paths remain redacted. `doctor` checks Node.js, the package-installed Wrangler binary, Cloudflare login, Worker health, the configured policy, the automatic-without-per-operation-prompts authorization model, and the same fixed local filesystem/process/shell/job-storage/resource probes exposed to the remote owner by `diagnose_runtime`. It constructs an isolated local runtime: `diagnosticScope.running_service_process_inspected=false` and `remote_relay_inspected=false` are deliberate, so a green doctor result is not evidence that the launchd/systemd/Scheduled Task daemon retained its Worker WebSocket. Inspect authenticated `server_info.daemon.relay_transport` for the running service relay. Authenticated `server_info.authorization.execution_model` reports the authority contract and identifies whether the account has daemon-OS-user ambient authority. Public `/healthz` output contains only server identity and version; daemon details require an authenticated `server_info` call.
 
-For interruption analysis, prefer one owner `diagnose_runtime` call over a chain of inventory probes. It now includes `runtime.managed_jobs.recent_activity`, `runtime.security_audit.recent_activity`, bounded `runtime.resource_admission.waiters.diagnostics`, `runtime.system_sleep`, `runtime.event_loop_pause_analysis`, and `runtime.relay_outage_analysis`. The audit aggregate contains only counts, bounded tool names, failure totals, calls-per-minute density, and numeric result-pressure fields (`output_bytes_last_15m`, `maximum_output_bytes_last_15m`, `large_result_calls_last_15m`, and `peak_output_bytes_per_minute_last_15m`) derived from the existing content-free hash-chained audit log; it contains no tool arguments or result content. Its `coverage=daemon_reached_relay_tool_calls_only` and `host_side_events_observable=false` fields make the evidence boundary explicit: host-only discovery/control-plane/final-delivery events are not counted. The waiter projection reports only resource-request shape and the current admission reason. On macOS with shell-capable owner diagnostics, the fixed power probe reduces `pmset` history to a small list of sleep start/end/duration/reason classes; it never returns raw power-log lines. `event_loop_pause_analysis.classification=matched_system_sleep` requires both the recorded runtime-stall end time and duration to match one of those bounded operating-system sleep intervals within a fixed tolerance. `relay_outage_analysis` separately compares the most recent completed `recent_outages[0].disconnected_at` -> `recent_outages[0].ready_at` interval with the same bounded sleep history and reports exact overlap duration/ratio; an active outage uses `outage_started_at` instead of the later `last_disconnected_at`. `majority_system_sleep_overlap` means at least half of that observed relay outage occurred while macOS was suspended. A sleeping JavaScript process may be unable to observe the stale socket until wake, so a zero-overlap close-to-ready interval is not automatically awake-network evidence: `wake_boundary_system_sleep_aftermath` is emitted only when the disconnect occurs within the fixed wake tolerance and that same sleep independently matches the event-loop stall in both end time and duration. Either sleep classification makes a retained `connection_reset`/timeout transport aftermath rather than sufficient evidence of a separate network root cause. `no_matching_recent_system_sleep` remains the classification for an awake reset or a merely coincidental near-wake reset without same-sleep stall evidence; it leaves the cause unassigned rather than guessing a VPN, edge, Worker, or host cause. Full relay diagnostics additionally expose `recent_outages`, a newest-first in-memory history capped at eight completed WebSocket reconnect episodes. Each entry contains only bounded outage numbering, first/final disconnect and ready timestamps, duration, close/error classes, previous-ready duration/silence, first-disconnect liveness phase/timing, coarse application-route class, and connection-stage timings. `disconnected_at` is the first outage transition and `last_disconnect_at` is the final failed reconnect transition. A protocol/application Pong that clears a liveness suspicion without rebuilding the WebSocket remains heartbeat evidence and is deliberately absent from `recent_outages`; the array is therefore reconnect history, not a list of every transient transport suspicion. ChatGPT host-turn termination/final-message receipt remains explicitly unobservable.
+For interruption analysis, prefer one owner `diagnose_runtime` call over a chain of inventory probes. It now includes `runtime.managed_jobs.recent_activity`, `runtime.security_audit.recent_activity`, bounded `runtime.resource_admission.waiters.diagnostics`, `runtime.system_sleep`, `runtime.event_loop_pause_analysis`, and `runtime.relay_outage_analysis`. The audit aggregate contains only counts, bounded tool names, failure totals, calls-per-minute density, and numeric result-pressure fields (`output_bytes_last_15m`, `maximum_output_bytes_last_15m`, `large_result_calls_last_15m`, and `peak_output_bytes_per_minute_last_15m`) derived from the existing content-free hash-chained audit log; it contains no tool arguments or result content. Its `coverage=daemon_reached_relay_tool_calls_only` and `host_side_events_observable=false` fields make the evidence boundary explicit: host-only discovery/control-plane/final-delivery events are not counted. The waiter projection reports only resource-request shape and the current admission reason. On macOS with shell-capable owner diagnostics, the fixed power probe reduces `pmset` history to a small list of sleep start/end/duration/reason classes; it never returns raw power-log lines. If that bounded power-history probe is unavailable or times out, `runtime.system_sleep` remains `supported=true` with `available=false` and an `error_class`, while the `system-sleep-history` check is retained as skipped auxiliary causality evidence. That auxiliary evidence gap does not by itself make `diagnose_runtime.ok=false`; relay readiness, local filesystem/process/shell execution, managed-job storage, resource admission, and registered-resource availability remain health gates. `event_loop_pause_analysis.classification=matched_system_sleep` requires both the recorded runtime-stall end time and duration to match one of those bounded operating-system sleep intervals within a fixed tolerance. `relay_outage_analysis` separately compares the most recent completed `recent_outages[0].disconnected_at` -> `recent_outages[0].ready_at` interval with the same bounded sleep history and reports exact overlap duration/ratio; an active outage uses `outage_started_at` instead of the later `last_disconnected_at`. `majority_system_sleep_overlap` means at least half of that observed relay outage occurred while macOS was suspended. A sleeping JavaScript process may be unable to observe the stale socket until wake, so a zero-overlap close-to-ready interval is not automatically awake-network evidence: `wake_boundary_system_sleep_aftermath` is emitted only when the disconnect occurs within the fixed wake tolerance and that same sleep independently matches the event-loop stall in both end time and duration. Either sleep classification makes a retained `connection_reset`/timeout transport aftermath rather than sufficient evidence of a separate network root cause. `no_matching_recent_system_sleep` remains the classification for an awake reset or a merely coincidental near-wake reset without same-sleep stall evidence; it leaves the cause unassigned rather than guessing a VPN, edge, Worker, or host cause. Full relay diagnostics additionally expose `recent_outages`, a newest-first in-memory history capped at eight completed WebSocket reconnect episodes. Each entry also carries `https_fallback_taken_over` and bounded `https_fallback_takeover_ms`, attributed by the stable WebSocket outage number; a later fallback takeover cannot relabel an earlier or no-takeover episode. The top-level `https_fallback_last_takeover_outage_number` is only a bounded correlation aid for the latest takeover and must not be applied to another outage number. Each entry contains only bounded outage numbering, first/final disconnect and ready timestamps, duration, close/error classes, previous-ready duration/silence, first-disconnect liveness phase/timing, coarse application-route class, and connection-stage timings. `disconnected_at` is the first outage transition and `last_disconnect_at` is the final failed reconnect transition. A protocol/application Pong that clears a liveness suspicion without rebuilding the WebSocket remains heartbeat evidence and is deliberately absent from `recent_outages`; the array is therefore reconnect history, not a list of every transient transport suspicion. ChatGPT host-turn termination/final-message receipt remains explicitly unobservable.
 
 `runtime.idle_sleep_guard` carries coarse activity/grace/release timestamps plus `mode`, `requests_idle_sleep_prevention`, `requests_system_sleep_prevention_on_ac`, `assertion_generation`, `restart_count`, `recovery_pending`, and bounded current/last unprotected duration. These fields are diagnostic ownership evidence only. The default `activity` mode is backward compatible: authorized relay activity holds `/usr/bin/caffeinate -i -s -w <owner-pid>` through execution and the fixed thirty-minute inactivity grace. In `activity` and `ac-continuous`, that grace begins only after the last owned daemon-side activity settles; a new authorized activity cancels a pending release and receives the full grace after it later settles. `machine-mcp idle-sleep set ac-continuous` adds a daemon-lifetime `/usr/bin/caffeinate -s -w <daemon-pid>` assertion while keeping the normal activity assertion, so idle-sleep prevention on battery remains activity-scoped. `machine-mcp idle-sleep set continuous` instead holds `/usr/bin/caffeinate -i -s -w <daemon-pid>` for the daemon lifetime and does not arm inactivity grace; restart the daemon/service after changing the persisted mode. Every assertion uses fixed 1/5/30-second recovery after unexpected child exit or setup failure, while explicit release/shutdown cancels recovery. The `-s` request is effective only on AC power; `continuous` adds `-i` specifically to request Idle Sleep prevention on battery as well. None of these modes claims to defeat explicit sleep, lid-close policy, power loss, or operating-system behavior outside the documented assertion contracts. Remote account managed-job runners retain their separate runner-owned assertion and now inherit the same bounded child self-healing.
 
@@ -171,7 +171,7 @@ npm --version
 machine-mcp --verbose
 ```
 
-The published runtime package does not install Wrangler or Miniflare into its global dependency tree. On the first start or deployment, Machine Bridge first constructs a private hardened npm 12.0.2 from exact integrity-pinned npm, undici 6.28.0, and brace-expansion 5.0.9 registry tarballs, then uses that CLI to install the exact private Wrangler toolchain under its owner-only state root. It audits the resulting production tree and verifies registry signatures before contacting Cloudflare. This requires npm registry access and may add one bounded setup step; do not manually edit either private toolchain directory. Candidate installation, published global installation, GitHub Release publication checks, and npm publication also create temporary hardened/private staging sessions. Published installation preserves the global prefix selected by the owner's npm. GitHub and npm artifacts must match the accepted candidate digest/hash evidence before service mutation. Permission, I/O, quota, memory, retry, stale-handle, storage, read-only-filesystem, or timeout errors are not treated as an empty/corrupt tree and must be corrected without deleting the state root.
+The published runtime package does not install Wrangler or Miniflare into its global dependency tree. On the first start or deployment, Machine Bridge first constructs a private hardened npm 12.0.2 from exact integrity-pinned npm, undici 6.28.0, and brace-expansion 5.0.9 registry tarballs, then uses that CLI to install the exact private Wrangler toolchain under its owner-only state root. It audits the resulting production tree and verifies registry signatures before contacting Cloudflare. This requires npm registry access and may add one bounded setup step; do not manually edit either private toolchain directory. Candidate installation, published global installation, GitHub Release publication checks, and npm publication also create temporary hardened/private staging sessions. Published installation preserves the global prefix selected by the owner's npm. GitHub and npm artifacts must match the accepted candidate digest/hash evidence before service mutation. GitHub release publication after merge does not reinstall the source dependency tree or repeat local `check:full`: it first fetches `origin/main`, requires local `HEAD` to equal that exact commit, and requires every configured push-triggered provider workflow for that commit to have succeeded. It then uses the hardened npm session to recheck synchronized versions and rematerialize the accepted candidate bytes/promotion digest. Immediately before any tag or GitHub Release mutation it fetches `origin/main` again and requires the same CI-verified commit; publication aborts if main moved. Remote asset SHA-256 reconciliation remains mandatory after upload. Permission, I/O, quota, memory, retry, stale-handle, storage, read-only-filesystem, or timeout errors are not treated as an empty/corrupt tree and must be corrected without deleting the state root.
 
 ### Ambiguous publication outcome
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "3.0.0-beta.185",
+  "version": "3.0.0-beta.190",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",
@@ -108,6 +108,7 @@
     "stdio:integration-test": "node tests/stdio-integration-test.mjs",
     "catalog:test": "node tests/catalog-test.mjs",
     "tool-arguments:test": "node tests/tool-argument-validation-test.mjs",
+    "managed-job-output-redaction:test": "node tests/managed-job-output-redaction-test.mjs",
     "managed-jobs:test": "node tests/managed-jobs-test.mjs",
     "ssh-key:test": "node tests/ssh-key-test.mjs",
     "full-access:test": "node tests/full-access-test.mjs",

package/scripts/github-release.mjs

@@ -10,13 +10,12 @@ import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
 import { runNetworkCommand } from "./network-retry.mjs";
-import { requireSuccessfulWorkflowRun } from "./release-ci.mjs";
+import { waitForSuccessfulWorkflowRun } from "./release-ci.mjs";
 import { tagSyncError } from "./release-state.mjs";
 import { verifyCurrentReleaseAcceptance } from "./release-acceptance.mjs";
 import { stageAcceptedCandidateTarball } from "./accepted-candidate-tarball.mjs";
 import { createHardenedNpmSession } from "./hardened-npm-session.mjs";
 import { nestedNpmEnvironment } from "../src/local/npm-environment.mjs";
-import { sourceDependencyTreeInstallArguments, sourceDependencyTreeInstallTimeoutMs } from "./source-dependency-tree.mjs";
 import { runExecutable } from "../src/local/shell.mjs";
 import { resolveTrustedGitExecutable } from "../src/local/trusted-git-executable.mjs";
 import { resolveTrustedGithubCli } from "../src/local/trusted-github-cli.mjs";
@@ -30,6 +29,8 @@ import { fileURLToPath } from "node:url";
 const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const git = resolveTrustedGitExecutable({ workspace: root });
 const gh = resolveTrustedGithubCli({ workspace: root });
+const RELEASE_CI_WAIT_TIMEOUT_MS = 30 * 60 * 1000;
+const RELEASE_CI_POLL_INTERVAL_MS = 15_000;
 process.chdir(root);
 
 function fail(message) {
@@ -92,17 +93,6 @@ async function runNpmScript(npmCli, task) {
   });
 }
 
-async function installSourceDependencyTree(npmCli) {
-  await runExecutable(process.execPath, [npmCli, ...sourceDependencyTreeInstallArguments(root)], {
-    cwd: root,
-    capture: true,
-    env: nestedNpmEnvironment(process.env),
-    timeoutMs: sourceDependencyTreeInstallTimeoutMs,
-    hardTimeout: true,
-    maxOutputBytes: 8 * 1024 * 1024,
-  });
-  ensureClean();
-}
 
 function packageMetadata() {
   const data = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
@@ -158,7 +148,7 @@ function remoteTagCommit(tag) {
   return (peeled ?? direct)?.[0] ?? null;
 }
 
-function assertSuccessfulCi(head) {
+async function waitForSuccessfulCi(head) {
   const required = [
     [".github/workflows/ci.yml", "CI"],
     [".github/workflows/codeql.yml", "CodeQL"],
@@ -166,34 +156,32 @@ function assertSuccessfulCi(head) {
     [".github/workflows/scorecard.yml", "OpenSSF Scorecard"],
     [".github/workflows/workflow-policy.yml", "Workflow Policy Gate"],
   ];
+  const deadlineMs = performance.now() + RELEASE_CI_WAIT_TIMEOUT_MS;
   const verified = [];
   for (const [workflow, name] of required) {
-    const text = outputNetwork(gh, [
-      "run",
-      "list",
-      "--workflow",
-      workflow,
-      "--commit",
-      head,
-      "--event",
-      "push",
-      "--limit",
-      "20",
-      "--json",
-      "databaseId,status,conclusion,headSha,event,createdAt,url",
-    ]);
-    let runs;
-    try { runs = JSON.parse(text); }
-    catch { fail(`GitHub Actions did not return valid JSON for ${name}`); }
+    const loadRuns = () => {
+      const text = outputNetwork(gh, [
+        "run", "list", "--workflow", workflow, "--commit", head, "--event", "push",
+        "--limit", "20", "--json", "databaseId,status,conclusion,headSha,event,createdAt,url",
+      ]);
+      try { return JSON.parse(text); }
+      catch { fail(`GitHub Actions did not return valid JSON for ${name}`); }
+    };
     let run;
-    try { run = requireSuccessfulWorkflowRun(runs, head, name); }
-    catch (error) { fail(String(error?.message || error)); }
+    try {
+      run = await waitForSuccessfulWorkflowRun(loadRuns, head, name, {
+        deadlineMs,
+        pollIntervalMs: RELEASE_CI_POLL_INTERVAL_MS,
+        now: () => performance.now(),
+      });
+    } catch (error) {
+      fail(String(error?.message || error));
+    }
     console.log(`GitHub Actions ${name} succeeded for ${head} (run ${run.databaseId}).`);
     verified.push(run);
   }
   return verified;
 }
-
 function releaseInfo(tag) {
   const args = ["api", githubReleaseByTagEndpoint(tag)];
   const result = runNetwork(gh, args, { capture: true, allowFailure: true });
@@ -230,7 +218,7 @@ async function assertCoreSync({ requireReleaseAsset }) {
   if (head !== originMain) {
     fail(`HEAD ${head} does not match origin/main ${originMain}`);
   }
-  assertSuccessfulCi(head);
+  await waitForSuccessfulCi(head);
 
   const localCommit = localTagCommit(tag);
   const localTagError = tagSyncError({ scope: "local", tag, head, commit: localCommit });
@@ -349,13 +337,14 @@ async function publishCurrent({ prereleaseMode = false } = {}) {
     fail(`CHANGELOG.md has no section for ${pkg.version}`);
   }
 
+  const releaseHead = exactReleaseHead();
+  await waitForSuccessfulCi(releaseHead);
+
   const npmSession = await createHardenedNpmSession();
   let acceptance;
   let candidate = null;
   let verificationError = null;
   try {
-    await installSourceDependencyTree(npmSession.cli);
-    await runNpmScript(npmSession.cli, "check");
     await runNpmScript(npmSession.cli, "version:check");
     ensureClean();
     acceptance = assertLocalAcceptance(npmSession.cli);
@@ -382,24 +371,19 @@ async function publishCurrent({ prereleaseMode = false } = {}) {
   let primaryError = null;
   let releaseVerified = false;
   try {
-    const head = output(git, ["rev-parse", "HEAD"]);
-    const originMain = output(git, ["rev-parse", "origin/main"]);
-    if (head !== originMain) {
-      fail("HEAD does not match origin/main; local acceptance must be committed, pushed through npm run github:push, reviewed, and merged before release publication");
-    }
-    assertSuccessfulCi(head);
+    revalidateReleaseHead(releaseHead);
 
     const existingLocal = localTagCommit(tag);
-    if (existingLocal && existingLocal !== head) {
-      fail(`local ${tag} points to ${existingLocal}, not ${head}`);
+    if (existingLocal && existingLocal !== releaseHead) {
+      fail(`local ${tag} points to ${existingLocal}, not ${releaseHead}`);
     }
     if (!existingLocal) {
       run(git, ["tag", "-a", tag, "-m", `Release ${pkg.version}`]);
     }
 
     const existingRemote = remoteTagCommit(tag);
-    if (existingRemote && existingRemote !== head) {
-      fail(`remote ${tag} points to ${existingRemote}, not ${head}`);
+    if (existingRemote && existingRemote !== releaseHead) {
+      fail(`remote ${tag} points to ${existingRemote}, not ${releaseHead}`);
     }
     if (!existingRemote) {
       runNetwork(git, ["push", "origin", tag]);
@@ -442,6 +426,24 @@ async function publishCurrent({ prereleaseMode = false } = {}) {
   await assertCoreSync({ requireReleaseAsset: true });
 }
 
+function exactReleaseHead() {
+  const head = output(git, ["rev-parse", "HEAD"]);
+  const originMain = output(git, ["rev-parse", "origin/main"]);
+  if (head !== originMain) {
+    fail(`HEAD ${head} does not match origin/main ${originMain}; merge the accepted candidate before release publication`);
+  }
+  return head;
+}
+
+function revalidateReleaseHead(expectedHead) {
+  ensureClean();
+  fetchRemote();
+  const currentHead = exactReleaseHead();
+  if (currentHead !== expectedHead) {
+    fail(`release source moved from verified main ${expectedHead} to ${currentHead}; restart publication against the new exact main`);
+  }
+}
+
 function assertStableSoak(npmCli = process.env.npm_execpath) {
   try {
     const result = verifyCurrentStableSoak(root, { npmCli });

package/scripts/release-ci.mjs

@@ -1,6 +1,62 @@
+import { performance } from "node:perf_hooks";
+
+const DEFAULT_WORKFLOW_POLL_INTERVAL_MS = 15_000;
+const DEFAULT_WORKFLOW_WAIT_TIMEOUT_MS = 30 * 60 * 1000;
+
 export function requireSuccessfulWorkflowRun(runs, head, workflowName = "CI") {
+  const run = latestPushWorkflowRun(runs, head, workflowName);
+  if (run.status !== "completed") {
+    throw new Error(`${workflowName} run ${run.databaseId || "unknown"} for release commit ${head} is ${run.status || "unknown"}; wait for completion and retry`);
+  }
+  if (run.conclusion !== "success") {
+    throw new Error(`${workflowName} run ${run.databaseId || "unknown"} for release commit ${head} concluded ${run.conclusion || "unknown"}; fix or rerun the workflow before release`);
+  }
+  return run;
+}
+
+export async function waitForSuccessfulWorkflowRun(loadRuns, head, workflowName = "CI", options = {}) {
+  if (typeof loadRuns !== "function") throw new Error("GitHub Actions run loader must be a function");
+  validateReleaseHead(head);
+  const now = typeof options.now === "function" ? options.now : () => performance.now();
+  const wait = typeof options.wait === "function" ? options.wait : defaultWorkflowWait;
+  const pollIntervalMs = positiveFinite(options.pollIntervalMs, DEFAULT_WORKFLOW_POLL_INTERVAL_MS, "workflow poll interval");
+  const deadlineMs = options.deadlineMs === undefined
+    ? now() + DEFAULT_WORKFLOW_WAIT_TIMEOUT_MS
+    : finiteDeadline(options.deadlineMs);
+  let observed = null;
+  for (;;) {
+    if (now() >= deadlineMs) throw workflowWaitTimeout(workflowName, head, observed);
+    const runs = await loadRuns();
+    let run = null;
+    try {
+      run = latestPushWorkflowRun(runs, head, workflowName);
+    } catch (error) {
+      if (!isMissingWorkflowRun(error, workflowName, head)) throw error;
+    }
+    if (run) {
+      observed = run;
+      if (run.status === "completed") {
+        if (run.conclusion !== "success") {
+          throw new Error(`${workflowName} run ${run.databaseId || "unknown"} for release commit ${head} concluded ${run.conclusion || "unknown"}; fix or rerun the workflow before release`);
+        }
+        return run;
+      }
+    } else {
+      observed = null;
+    }
+    const remainingMs = deadlineMs - now();
+    if (!(remainingMs > 0)) throw workflowWaitTimeout(workflowName, head, observed);
+    await wait(Math.min(pollIntervalMs, remainingMs));
+  }
+}
+
+export function requireSuccessfulCiRun(runs, head) {
+  return requireSuccessfulWorkflowRun(runs, head, "CI");
+}
+
+function latestPushWorkflowRun(runs, head, workflowName) {
   if (!Array.isArray(runs)) throw new Error("GitHub Actions response is not an array");
-  if (!/^[0-9a-f]{40,64}$/i.test(String(head || ""))) throw new Error("release commit SHA is invalid");
+  validateReleaseHead(head);
   const label = String(workflowName || "workflow");
   const matching = runs
     .filter((run) => run && run.headSha === head && run.event === "push")
@@ -9,15 +65,38 @@ export function requireSuccessfulWorkflowRun(runs, head, workflowName = "CI") {
   if (!run) {
     throw new Error(`no push-triggered ${label} run exists for release commit ${head}; wait for GitHub Actions to register the run and retry`);
   }
-  if (run.status !== "completed") {
-    throw new Error(`${label} run ${run.databaseId || "unknown"} for release commit ${head} is ${run.status || "unknown"}; wait for completion and retry`);
-  }
-  if (run.conclusion !== "success") {
-    throw new Error(`${label} run ${run.databaseId || "unknown"} for release commit ${head} concluded ${run.conclusion || "unknown"}; fix or rerun the workflow before release`);
-  }
   return run;
 }
 
-export function requireSuccessfulCiRun(runs, head) {
-  return requireSuccessfulWorkflowRun(runs, head, "CI");
+function validateReleaseHead(head) {
+  if (!/^[0-9a-f]{40,64}$/i.test(String(head || ""))) throw new Error("release commit SHA is invalid");
+}
+
+function positiveFinite(value, fallback, label) {
+  if (value === undefined) return fallback;
+  const number = Number(value);
+  if (!Number.isFinite(number) || number <= 0) throw new Error(`${label} must be a positive finite number`);
+  return number;
+}
+
+function finiteDeadline(value) {
+  const number = Number(value);
+  if (!Number.isFinite(number)) throw new Error("workflow wait deadline must be finite");
+  return number;
+}
+
+function isMissingWorkflowRun(error, workflowName, head) {
+  return String(error?.message || error).startsWith(`no push-triggered ${String(workflowName || "workflow")} run exists for release commit ${head};`);
+}
+
+function workflowWaitTimeout(workflowName, head, run) {
+  const label = String(workflowName || "workflow");
+  const state = run
+    ? `latest run ${run.databaseId || "unknown"} remained ${run.status || "unknown"}`
+    : "no exact-commit push run was registered";
+  return new Error(`${label} did not succeed for release commit ${head} before the finite CI wait deadline; ${state}`);
+}
+
+function defaultWorkflowWait(ms) {
+  return new Promise((resolvePromise) => { setTimeout(resolvePromise, ms); });
 }

package/src/local/agent-context.mjs

@@ -256,7 +256,30 @@ export class AgentContextManager {
     };
   }
 
-  async discoverState(inputPath, context = {}) {
+  async managedJobCommandForLocalInvocation(args = {}, context = {}) {
+    const command = await this.resolveLocalCommand(args, context);
+    return command.executionMode === "managed_job" ? managedJobCommandSummary(command) : null;
+  }
+
+  async managedJobCommandForDirectInvocation(args = {}, context = {}) {
+    const argv = args.argv;
+    if (!Array.isArray(argv) || argv.length === 0 || argv.some((value) => typeof value !== "string")) return null;
+    const state = await this.discoverState(args.cwd || ".", context, { includeUserGlobalContext: false });
+    if (state.target !== state.targetDir) return null;
+    for (const command of state.commands.values()) {
+      if (command.executionMode !== "managed_job" || !sameArgv(command.argv, argv)) continue;
+      let commandCwd;
+      try { commandCwd = await realpath(command.cwd); }
+      catch (error) {
+        if (error?.code === "ENOENT" || error?.code === "ENOTDIR") continue;
+        throw error;
+      }
+      if (commandCwd === state.target) return managedJobCommandSummary(command);
+    }
+    return null;
+  }
+
+  async discoverState(inputPath, context = {}, options = {}) {
     this.throwIfCancelled(context);
     const effectivePolicy = this.policyForContext(context);
     this.workspace = await realpath(this.workspace);
@@ -269,14 +292,14 @@ export class AgentContextManager {
       unrestricted: effectivePolicy.unrestrictedPaths === true,
     });
     const directories = directoriesBetween(scopeRoot, targetDir);
-    const userGlobalContextAllowed = allowsUserGlobalContext(context, effectivePolicy);
+    const userGlobalContextAllowed = options.includeUserGlobalContext !== false && allowsUserGlobalContext(context, effectivePolicy);
     const state = {
       target,
       targetDir,
       scopeRoot,
       instructionFiles: [...DEFAULT_INSTRUCTION_FILES],
       instructionMaxBytes: DEFAULT_INSTRUCTION_MAX_BYTES,
-      skillRoots: defaultSkillRoots(directories, this.home, this.codexHome, effectivePolicy.unrestrictedPaths === true),
+      skillRoots: defaultSkillRoots(directories, this.home, this.codexHome, userGlobalContextAllowed && effectivePolicy.unrestrictedPaths === true),
       commands: new Map(),
       builtinInstructionsEnabled: true,
       automaticProjectContextEnabled: true,
@@ -428,6 +451,14 @@ export class AgentContextManager {
   }
 }
 
+function sameArgv(left, right) {
+  return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+
+function managedJobCommandSummary(command) {
+  return Object.freeze({ name: command.name, managedJobTimeoutSeconds: command.managedJobTimeoutSeconds });
+}
+
 async function findScopeRoot({ targetDir, workspace, unrestricted }) {
   const target = await realpath(targetDir);
   const canonicalWorkspace = await realpath(workspace);

package/src/local/managed-job-output-redaction.mjs

@@ -11,23 +11,10 @@ export function managedJobResourcePathVariants(value, platform = process.platfor
 
 export function redactManagedJobOutput(buffer, context, runtimeDir, platform = process.platform, truncatedBytes = 0) {
   const safeBuffer = discardUnsafeTruncationTail(buffer, context, runtimeDir, platform, truncatedBytes);
-  let redactedBytes = safeBuffer;
-  for (const [name, value] of Object.entries(context.bytes || {})) {
-    redactedBytes = replaceBuffer(redactedBytes, value, Buffer.from(`<redacted-resource:${name}>`));
-  }
+  const redactedBytes = replaceBufferEntries(safeBuffer, byteRedactionEntries(context, runtimeDir));
   let text = new TextDecoder("utf-8").decode(redactedBytes);
-  for (const [name, path] of Object.entries(context.paths)) {
-    text = replacePathText(text, path, `<resource:${name}>`, platform);
-  }
-  for (const [name, paths] of Object.entries(context.sourcePaths || {})) {
-    for (const path of paths) text = replacePathText(text, path, `<resource-source:${name}>`, platform);
-  }
-  for (const [name, path] of Object.entries(context.temporaryPaths)) {
-    text = replacePathText(text, path, `<temp:${name}>`, platform);
-  }
-  text = replacePathText(text, runtimeDir, "<job-runtime>", platform);
-  for (const [name, patterns] of Object.entries(context.redactions)) {
-    for (const value of patterns) text = text.split(value).join(`<redacted-resource:${name}>`);
+  for (const entry of textRedactionEntries(context, runtimeDir, platform)) {
+    text = replaceTextEntry(text, entry, platform);
   }
   return text;
 }
@@ -57,14 +44,62 @@ function protectedBytePatterns(context, runtimeDir, platform) {
   }
   for (const path of Object.values(context.temporaryPaths || {})) values.push(...managedJobResourcePathVariants(path, platform).map((value) => Buffer.from(value)));
   values.push(...managedJobResourcePathVariants(runtimeDir, platform).map((value) => Buffer.from(value)));
-  for (const patterns of Object.values(context.redactions || {})) {
-    for (const value of patterns || []) if (value) values.push(Buffer.from(value));
-  }
+  for (const [, value] of literalRedactionEntries(context)) values.push(Buffer.from(value));
   const unique = new Map();
   for (const value of values) if (value.length) unique.set(value.toString("hex"), value);
   return [...unique.values()].sort((left, right) => right.length - left.length);
 }
 
+function literalRedactionEntries(context) {
+  const entries = [];
+  for (const [name, patterns] of Object.entries(context.redactions || {})) {
+    if (!Array.isArray(patterns)) continue;
+    for (const value of patterns) {
+      if (typeof value === "string" && value.length > 0) entries.push([name, value]);
+    }
+  }
+  return entries.sort((left, right) => right[1].length - left[1].length);
+}
+
+function pathRedactionEntries(context, runtimeDir) {
+  const entries = [];
+  const add = (value, replacement) => {
+    for (const variant of pathTextVariants(value)) {
+      if (variant) entries.push({ value: variant, replacement, caseInsensitive: true });
+    }
+  };
+  for (const [name, path] of Object.entries(context.paths || {})) add(path, `<resource:${name}>`);
+  for (const [name, paths] of Object.entries(context.sourcePaths || {})) {
+    for (const path of paths || []) add(path, `<resource-source:${name}>`);
+  }
+  for (const [name, path] of Object.entries(context.temporaryPaths || {})) add(path, `<temp:${name}>`);
+  add(runtimeDir, "<job-runtime>");
+  return entries;
+}
+
+function textRedactionEntries(context, runtimeDir, platform) {
+  if (platform !== "win32") return [];
+  return pathRedactionEntries(context, runtimeDir)
+    .map((entry) => ({ ...entry, caseInsensitive: true }))
+    .sort((left, right) => right.value.length - left.value.length);
+}
+
+function byteRedactionEntries(context, runtimeDir) {
+  const entries = [];
+  for (const [name, value] of Object.entries(context.bytes || {})) {
+    if (Buffer.isBuffer(value) && value.length > 0) {
+      entries.push({ pattern: value, replacement: Buffer.from(`<redacted-resource:${name}>`) });
+    }
+  }
+  for (const entry of pathRedactionEntries(context, runtimeDir)) {
+    entries.push({ pattern: Buffer.from(entry.value), replacement: Buffer.from(entry.replacement) });
+  }
+  for (const [name, value] of literalRedactionEntries(context)) {
+    entries.push({ pattern: Buffer.from(value), replacement: Buffer.from(`<redacted-resource:${name}>`) });
+  }
+  return entries.sort((left, right) => right.pattern.length - left.pattern.length);
+}
+
 function partialSuffixLength(buffer, pattern) {
   if (!pattern?.length || !buffer.length) return 0;
   if (pattern.length <= buffer.length && buffer.subarray(buffer.length - pattern.length).equals(pattern)) return 0;
@@ -80,19 +115,22 @@ function partialSuffixLength(buffer, pattern) {
   return 0;
 }
 
-function replaceBuffer(buffer, pattern, replacement) {
-  if (!Buffer.isBuffer(pattern) || pattern.length === 0 || buffer.length < pattern.length) return buffer;
-  let offset = 0;
-  let match = buffer.indexOf(pattern, offset);
-  if (match < 0) return buffer;
+function replaceBufferEntries(buffer, entries) {
+  if (!Buffer.isBuffer(buffer) || buffer.length === 0 || entries.length === 0) return buffer;
   const parts = [];
-  while (match >= 0) {
-    if (match > offset) parts.push(buffer.subarray(offset, match));
-    parts.push(replacement);
-    offset = match + pattern.length;
-    match = buffer.indexOf(pattern, offset);
+  let cursor = 0;
+  let literalStart = 0;
+  while (cursor < buffer.length) {
+    const entry = entries.find(({ pattern }) => cursor + pattern.length <= buffer.length
+      && buffer.subarray(cursor, cursor + pattern.length).equals(pattern));
+    if (!entry) { cursor += 1; continue; }
+    if (cursor > literalStart) parts.push(buffer.subarray(literalStart, cursor));
+    parts.push(entry.replacement);
+    cursor += entry.pattern.length;
+    literalStart = cursor;
   }
-  if (offset < buffer.length) parts.push(buffer.subarray(offset));
+  if (literalStart === 0) return buffer;
+  if (literalStart < buffer.length) parts.push(buffer.subarray(literalStart));
   return Buffer.concat(parts);
 }
 
@@ -101,14 +139,12 @@ function pathTextVariants(value) {
   return [...new Set([path, path.replaceAll("\\", "/"), path.replaceAll("/", "\\")])];
 }
 
-function replacePathText(text, value, replacement, platform) {
-  let output = text;
-  for (const variant of pathTextVariants(value)) {
-    if (!variant) continue;
-    if (platform === "win32") output = output.replace(new RegExp(escapeRegExp(variant), "gi"), replacement);
-    else output = output.split(variant).join(replacement);
+function replaceTextEntry(text, entry, platform) {
+  if (!entry.value) return text;
+  if (platform === "win32" && entry.caseInsensitive) {
+    return text.replace(new RegExp(escapeRegExp(entry.value), "gi"), entry.replacement);
   }
-  return output;
+  return text.split(entry.value).join(entry.replacement);
 }
 
 function escapeRegExp(value) {

package/src/local/relay-peer-diagnostics.mjs

@@ -70,6 +70,7 @@ export function relayHandshakeDiagnostics(value = {}) {
     previous_ready_duration_ms: clampInteger(status.last_ready_duration_ms, 0, 0, 365 * 24 * 60 * 60_000),
     previous_ready_inbound_silence_ms: clampInteger(status.last_ready_inbound_silence_ms, 0, 0, 31 * 24 * 60 * 60_000),
     https_fallback_last_takeover_ms: clampInteger(status.https_fallback_last_takeover_ms, 0, 0, 10 * 60_000),
+    https_fallback_last_takeover_outage_number: clampInteger(status.https_fallback_last_takeover_outage_number, 0, 0, 1_000_000_000),
   };
 }
 
@@ -80,12 +81,16 @@ function recentOutages(value) {
     if (!isPlainRecord(candidate)) continue;
     const outageNumber = Number(candidate.outage_number);
     if (!Number.isSafeInteger(outageNumber) || outageNumber < 1 || outageNumber > 1_000_000_000) continue;
+    const fallbackTakenOver = candidate.https_fallback_taken_over === true;
     result.push({
       outage_number: outageNumber,
       disconnected_at: boundedTimestamp(candidate.disconnected_at),
       last_disconnect_at: boundedTimestamp(candidate.last_disconnect_at),
       ready_at: boundedTimestamp(candidate.ready_at),
       duration_ms: clampInteger(candidate.duration_ms, 0, 0, 31 * 24 * 60 * 60_000),
+      https_fallback_taken_over: fallbackTakenOver,
+      https_fallback_takeover_ms: fallbackTakenOver
+        ? clampInteger(candidate.https_fallback_takeover_ms, 0, 0, 10 * 60_000) : 0,
       attempts: clampInteger(candidate.attempts, 0, 0, 1_000_000),
       close_category: typeof candidate.close_category === "string" ? candidate.close_category.slice(0, 128) : null,
       close_code: Number.isSafeInteger(candidate.close_code) && candidate.close_code >= 0 && candidate.close_code <= 4999

package/src/local/resilient-relay-connection.mjs

@@ -17,6 +17,8 @@ export class ResilientRelayConnection {
     this.fallbackTimer = null;
     this.fallbackRecoveredOutageMs = 0;
     this.lastFallbackTakeoverMs = 0;
+    this.lastFallbackTakeoverOutageNumber = 0;
+    this.fallbackTakeoversByOutage = new Map();
     const WebSocketRelayClass = options.WebSocketRelayClass || RelayConnection;
     const HttpRelayClass = options.HttpRelayClass || DaemonHttpRelayConnection;
     this.websocket = new WebSocketRelayClass({
@@ -53,13 +55,15 @@ export class ResilientRelayConnection {
     this.activeTransport = "";
     this.fallbackRecoveredOutageMs = 0;
     this.lastFallbackTakeoverMs = 0;
+    this.lastFallbackTakeoverOutageNumber = 0;
+    this.fallbackTakeoversByOutage.clear();
     this.startResolve?.(false);
     this.startResolve = null;
     this.startPromise = null;
   }
 
   status() {
-    const websocket = this.websocket.status();
+    const websocket = this.projectWebSocketStatus(this.websocket.status());
     const http = this.http.status();
     if (this.activeTransport === "https" && http.ready) {
       return {
@@ -84,6 +88,7 @@ export class ResilientRelayConnection {
         https_fallback_warming: false,
         https_fallback_standby: false,
         https_fallback_last_takeover_ms: this.lastFallbackTakeoverMs,
+        https_fallback_last_takeover_outage_number: this.lastFallbackTakeoverOutageNumber,
       };
     }
     return {
@@ -94,6 +99,7 @@ export class ResilientRelayConnection {
       https_fallback_standby: http.standby === true,
       https_fallback: http,
       https_fallback_last_takeover_ms: this.lastFallbackTakeoverMs,
+      https_fallback_last_takeover_outage_number: this.lastFallbackTakeoverOutageNumber,
     };
   }
 
@@ -153,13 +159,15 @@ export class ResilientRelayConnection {
       this.clearFallbackTimer();
       this.armFallback(0, "", true);
     } else {
-      if (this.websocket.status().ready === true) {
+      const websocket = this.websocket.status();
+      if (websocket.ready === true) {
         this.http.stop();
         this.armFallback(this.standbyDelayMs, "", true);
         return;
       }
-      this.fallbackRecoveredOutageMs = Math.max(0, Number(this.websocket.status().outage_duration_ms) || 0);
-      this.lastFallbackTakeoverMs = this.fallbackRecoveredOutageMs;
+      this.fallbackRecoveredOutageMs = Math.max(0, Number(websocket.outage_duration_ms) || 0);
+      this.lastFallbackTakeoverMs = boundedFallbackTakeoverMs(this.fallbackRecoveredOutageMs);
+      this.recordFallbackTakeover(websocket);
       this.activeTransport = "https";
     }
     this.startResolve?.(true);
@@ -192,6 +200,46 @@ export class ResilientRelayConnection {
     if (this.http.status().closed === true) this.armFallback(0, "", true);
   }
 
+  recordFallbackTakeover(websocket = {}) {
+    const outageNumber = relayOutageNumber(websocket.outage_count);
+    if (websocket.outage_active !== true || outageNumber === 0) return;
+    this.lastFallbackTakeoverOutageNumber = outageNumber;
+    this.fallbackTakeoversByOutage.set(outageNumber, this.lastFallbackTakeoverMs);
+    this.pruneFallbackTakeovers(websocket);
+  }
+
+  projectWebSocketStatus(websocket = {}) {
+    this.pruneFallbackTakeovers(websocket);
+    const recentOutages = Array.isArray(websocket.recent_outages) ? websocket.recent_outages : [];
+    return {
+      ...websocket,
+      recent_outages: recentOutages.map((entry) => {
+        const outageNumber = relayOutageNumber(entry?.outage_number);
+        const hasTakeover = outageNumber > 0 && this.fallbackTakeoversByOutage.has(outageNumber);
+        return {
+          ...entry,
+          https_fallback_taken_over: hasTakeover,
+          https_fallback_takeover_ms: hasTakeover ? this.fallbackTakeoversByOutage.get(outageNumber) : 0,
+        };
+      }),
+    };
+  }
+
+  pruneFallbackTakeovers(websocket = {}) {
+    const retained = new Set();
+    const activeOutageNumber = websocket.outage_active === true ? relayOutageNumber(websocket.outage_count) : 0;
+    if (activeOutageNumber > 0) retained.add(activeOutageNumber);
+    if (Array.isArray(websocket.recent_outages)) {
+      for (const entry of websocket.recent_outages) {
+        const outageNumber = relayOutageNumber(entry?.outage_number);
+        if (outageNumber > 0) retained.add(outageNumber);
+      }
+    }
+    for (const outageNumber of this.fallbackTakeoversByOutage.keys()) {
+      if (!retained.has(outageNumber)) this.fallbackTakeoversByOutage.delete(outageNumber);
+    }
+  }
+
   armFallback(delay, takeoverWebSocketConnectionId = "", allowReadyWebSocket = false) {
     if (this.closed) return;
     const takeoverWebSocket = /^connection_[A-Za-z0-9_-]{43}$/.test(String(takeoverWebSocketConnectionId || ""));
@@ -215,6 +263,17 @@ export class ResilientRelayConnection {
   }
 }
 
+function relayOutageNumber(value) {
+  const number = Number(value);
+  return Number.isSafeInteger(number) && number > 0 && number <= 1_000_000_000 ? number : 0;
+}
+
+function boundedFallbackTakeoverMs(value) {
+  const number = Number(value);
+  if (!Number.isFinite(number) || number <= 0) return 0;
+  return Math.min(10 * 60_000, Math.round(number));
+}
+
 function positiveInteger(value, fallback) {
   const number = Number(value);
   return Number.isFinite(number) && number > 0 ? Math.floor(number) : fallback;

package/src/local/runtime-diagnostics.mjs

@@ -44,7 +44,7 @@ export async function diagnoseRuntime({
     last_transport_error_class: relay.last_transport_error_class || null,
     last_disconnected_at: relay.last_disconnected_at || null,
     last_ready_at: relay.last_ready_at || null, last_ready_duration_ms: Number(relay.last_ready_duration_ms) || 0,
-    https_fallback_last_takeover_ms: Number(relay.https_fallback_last_takeover_ms) || 0, next_reconnect_in_ms: Number(relay.next_reconnect_in_ms) || 0,
+    https_fallback_last_takeover_ms: Number(relay.https_fallback_last_takeover_ms) || 0, https_fallback_last_takeover_outage_number: Number(relay.https_fallback_last_takeover_outage_number) || 0, next_reconnect_in_ms: Number(relay.next_reconnect_in_ms) || 0,
     heartbeat: relay.heartbeat || null,
   } : {
     layer: "remote-relay", ok: false, skipped: true, transport: "stdio-or-local",

package/src/local/runtime-info-relay-projection.mjs

@@ -18,5 +18,6 @@ export function compactRuntimeRelay(value) {
     https_fallback_active: value.https_fallback_active === true,
     websocket_ready: value.websocket_ready === true,
     https_fallback_last_takeover_ms: value.https_fallback_last_takeover_ms ?? 0,
+    https_fallback_last_takeover_outage_number: value.https_fallback_last_takeover_outage_number ?? 0,
   };
 }

package/src/local/runtime-process-routing.mjs

@@ -4,12 +4,16 @@ import {
   prepareDurableShellProcess,
 } from "./durable-process-spec.mjs";
 import { settleDurableProcessAcceptance } from "./durable-process-initial-settlement.mjs";
+import { BridgeError } from "./errors.mjs";
 
 function usesDurableProcessDelivery(args, context = {}) {
   return context.origin === "relay" || args?.idempotency_key !== undefined;
 }
 
 export async function runRuntimeDirectProcess(runtime, args, context = {}) {
+  runtime.processExecutionService.policyGate.assert("run_process");
+  const managedCommand = await runtime.agentContextManager.managedJobCommandForDirectInvocation(args, context);
+  if (managedCommand) throw managedJobOnlyCarrierError(managedCommand);
   if (!usesDurableProcessDelivery(args, context)) {
     return runtime.processExecutionService.runDirect(args, context);
   }
@@ -19,6 +23,9 @@ export async function runRuntimeDirectProcess(runtime, args, context = {}) {
 }
 
 export async function runRuntimeLocalCommand(runtime, args, context = {}) {
+  runtime.processExecutionService.policyGate.assert("run_local_command");
+  const managedCommand = await runtime.agentContextManager.managedJobCommandForLocalInvocation(args, context);
+  if (managedCommand) throw managedJobOnlyCarrierError(managedCommand);
   if (!usesDurableProcessDelivery(args, context)) {
     return runtime.processExecutionService.runRegistered(args, context);
   }
@@ -35,3 +42,10 @@ export async function runRuntimeExecCommand(runtime, args, context = {}) {
   }
   return runtime.processExecutionService.runShell(args.command, args.timeout_seconds, context);
 }
+
+function managedJobOnlyCarrierError(command) {
+  return new BridgeError("invalid_request", `registered command '${command.name}' requires start_job; run_process and run_local_command intentionally refuse execution_mode=managed_job commands`, {
+    retryable: false,
+    details: { side_effects_started: false, required_tool: "start_job", registered_command: command.name, managed_job_timeout_seconds: command.managedJobTimeoutSeconds },
+  });
+}

package/src/local/system-sleep-diagnostics.mjs

@@ -20,13 +20,17 @@ export async function systemSleepDiagnostic({ runFixedInternal, context, workspa
       check: { layer: "system-sleep-history", ok: true, recent_sleep_intervals: intervals.length },
     };
   } catch (error) {
-    return {
-      snapshot: { supported: true, available: false, source: "macos_pmset", recent_sleep_intervals: [], error_class: classifyOperationalError(error) },
-      check: { layer: "system-sleep-history", ok: false, error_class: classifyOperationalError(error) },
-    };
+    return unavailableSystemSleepHistory(classifyOperationalError(error));
   }
 }
 
+function unavailableSystemSleepHistory(errorClass) {
+  return {
+    snapshot: { supported: true, available: false, source: "macos_pmset", recent_sleep_intervals: [], error_class: errorClass },
+    check: { layer: "system-sleep-history", ok: false, skipped: true, error_class: errorClass },
+  };
+}
+
 export function parseSystemSleepIntervals(text, limit = 8) {
   const intervals = [];
   for (const line of String(text || "").split(/\r?\n/)) {

package/src/worker/daemon-http-controller.ts

@@ -6,6 +6,7 @@ import type { DaemonHttpChannel } from "./daemon-http-channel.ts";
 import { normalizeDaemonHttpExchange } from "./daemon-http-protocol.ts";
 import type { DaemonRegistry } from "./daemon-registry.ts";
 import { handleReadyDaemonMessage } from "./daemon-ready-messages.ts";
+import { beginDaemonResumeReconciliation } from "./daemon-resume-reconciliation.ts";
 import { notifyReadyDaemon } from "./daemon-ready-waiters.ts";
 import { HttpError, json, readBoundedBytes } from "./http.ts";
 import type { WorkerObservability } from "./observability.ts";
@@ -77,6 +78,7 @@ export async function handleDaemonHttpRelay(input: {
     const queuedRevocations = await authorityRevocations(input.storage);
     input.registry.http.activate(exchange.sessionId, channel.activationToken, now);
     const rebound = input.pending.rebindInstance(exchange.instanceId, channel);
+    beginDaemonResumeReconciliation(channel, rebound);
     channel.send(JSON.stringify({ type: "resume_calls", ids: rebound }));
     for (const revocation of queuedRevocations) channel.send(JSON.stringify(authorityRevocationWireMessage(revocation)));
     channel.send(JSON.stringify({ type: "ready_ack", server: input.server, version: input.version }));
@@ -147,6 +149,7 @@ export async function handleDaemonHttpRelay(input: {
 async function invalidate(channel: DaemonHttpChannel, input: Parameters<typeof handleDaemonHttpRelay>[0], code: string): Promise<Response> {
   await input.detachChannel(channel, `HTTPS fallback protocol failure: ${code}`);
   input.registry.http.close(channel);
+  input.observability.socketProtocolError(code);
   input.observability.event("warn", "daemon.https_fallback.invalidated", { error_class: code });
   await input.scheduleAlarm();
   return json({ error: code }, 409);

package/src/worker/daemon-ready-messages.ts

@@ -1,7 +1,7 @@
 import { acknowledgeAuthorityRevocation, authorityRevocationAckId } from "./authority-revocations.ts";
 import type { DaemonChannel } from "./daemon-channel.ts";
 import { settleDaemonPlannedDrain } from "./daemon-planned-drain.ts";
-import { daemonResumeMissingCallIds } from "./websocket-protocol.ts";
+import { daemonResumeAcknowledgement } from "./daemon-resume-reconciliation.ts";
 import { daemonCallNotReceivedAfterReconnectError, daemonToolError } from "./errors.ts";
 import type { PendingCallOutcome } from "./pending-call-contract.ts";
 import type { PendingCallRegistry } from "./pending-calls.ts";
@@ -24,9 +24,9 @@ export async function handleReadyDaemonMessage(input: {
 }): Promise<ReadyMessageDisposition> {
   const { channel, body, pending, storage, observability, beginDrain } = input;
   if (body.type === "resume_calls_ack") {
-    const missingIds = daemonResumeMissingCallIds(body.missing_ids);
-    if (!missingIds) return invalid("invalid_resume_calls_ack", "invalid resume calls acknowledgement");
-    await settleDaemonProvenMissingCalls({ ids: missingIds, channel, pending, observability });
+    const acknowledgement = daemonResumeAcknowledgement(channel, body.missing_ids);
+    if (!acknowledgement) return invalid("invalid_resume_calls_ack", "invalid resume calls acknowledgement");
+    if (!acknowledgement.duplicate) await settleDaemonProvenMissingCalls({ ids: acknowledgement.missingIds, channel, pending, observability });
     return { ok: true };
   }
   if (body.type === "authority_revoke_ack") {
@@ -62,7 +62,9 @@ export async function settleDaemonProvenMissingCalls(input: {
   const rejected = await input.pending.rejectSocketIds(
     input.ids, input.channel, (record) => daemonCallNotReceivedAfterReconnectError(record.recovery), undefined,
     (record) => {
+      if (record.provenMissingRedeliveryChannel) return record.provenMissingRedeliveryChannel === input.channel;
       if (record.redeliverAfterProvenMissing?.(record, input.channel) !== true) return false;
+      record.provenMissingRedeliveryChannel = input.channel;
       redelivered += 1; return true;
     },
   );

package/src/worker/daemon-relay-diagnostics.ts

@@ -54,6 +54,8 @@ export interface DaemonRelayOutageDiagnostics {
   last_disconnect_at: string | null;
   ready_at: string | null;
   duration_ms: number;
+  https_fallback_taken_over: boolean;
+  https_fallback_takeover_ms: number;
   attempts: number;
   close_category: string | null;
   close_code: number | null;
@@ -129,6 +131,7 @@ export interface DaemonRelayDiagnostics {
   previous_ready_duration_ms: number;
   previous_ready_inbound_silence_ms: number;
   https_fallback_last_takeover_ms: number;
+  https_fallback_last_takeover_outage_number: number;
 }
 
 export function sanitizeDaemonRelayDiagnostics(value: unknown): DaemonRelayDiagnostics | undefined {
@@ -184,6 +187,7 @@ export function sanitizeDaemonRelayDiagnostics(value: unknown): DaemonRelayDiagn
     previous_ready_duration_ms: boundedInteger(candidate.previous_ready_duration_ms, 0, 365 * 24 * 60 * 60_000, 0),
     previous_ready_inbound_silence_ms: boundedInteger(candidate.previous_ready_inbound_silence_ms, 0, 31 * 24 * 60 * 60_000, 0),
     https_fallback_last_takeover_ms: boundedInteger(candidate.https_fallback_last_takeover_ms, 0, 10 * 60_000, 0),
+    https_fallback_last_takeover_outage_number: boundedInteger(candidate.https_fallback_last_takeover_outage_number, 0, 1_000_000_000, 0),
   };
 }
 
@@ -225,12 +229,16 @@ function recoveredOutage(
   readyAt: string,
   durationMs: number,
 ): DaemonRelayOutageDiagnostics {
+  const fallbackTakenOver = value.outage_count > 0
+    && value.https_fallback_last_takeover_outage_number === value.outage_count;
   return {
     outage_number: value.outage_count,
     disconnected_at: value.outage_started_at ?? value.last_disconnected_at,
     last_disconnect_at: value.last_disconnected_at,
     ready_at: readyAt,
     duration_ms: boundedInteger(durationMs, 0, 31 * 24 * 60 * 60_000, 0),
+    https_fallback_taken_over: fallbackTakenOver,
+    https_fallback_takeover_ms: fallbackTakenOver ? value.https_fallback_last_takeover_ms : 0,
     attempts: value.outage_attempts,
     close_category: value.last_close_category,
     close_code: value.last_close_code,
@@ -293,12 +301,16 @@ function recentOutages(value: unknown): DaemonRelayOutageDiagnostics[] {
     const entry = candidate as Record<string, unknown>;
     const outageNumber = Number(entry.outage_number);
     if (!Number.isSafeInteger(outageNumber) || outageNumber < 1 || outageNumber > 1_000_000_000) continue;
+    const fallbackTakenOver = entry.https_fallback_taken_over === true;
     result.push({
       outage_number: outageNumber,
       disconnected_at: timestamp(entry.disconnected_at),
       last_disconnect_at: timestamp(entry.last_disconnect_at),
       ready_at: timestamp(entry.ready_at),
       duration_ms: boundedInteger(entry.duration_ms, 0, 31 * 24 * 60 * 60_000, 0),
+      https_fallback_taken_over: fallbackTakenOver,
+      https_fallback_takeover_ms: fallbackTakenOver
+        ? boundedInteger(entry.https_fallback_takeover_ms, 0, 10 * 60_000, 0) : 0,
       attempts: boundedInteger(entry.attempts, 0, 1_000_000, 0),
       close_category: nullableEnum(entry.close_category, CLOSE_CATEGORIES),
       close_code: nullableInteger(entry.close_code, 0, 4999),

package/src/worker/daemon-resume-reconciliation.ts

@@ -0,0 +1,43 @@
+import type { DaemonChannel } from "./daemon-channel.ts";
+import { daemonResumeMissingCallIds } from "./websocket-protocol.ts";
+
+type ResumeReconciliation = {
+  expectedIds: ReadonlySet<string>;
+  acknowledgedMissingKey?: string;
+};
+
+export type DaemonResumeAcknowledgementDisposition = Readonly<{ ok: boolean; duplicate: boolean }>;
+export type DaemonResumeAcknowledgement = Readonly<{ missingIds: readonly string[]; duplicate: boolean }>;
+
+const reconciliations = new WeakMap<DaemonChannel, ResumeReconciliation>();
+
+export function beginDaemonResumeReconciliation(channel: DaemonChannel, ids: readonly string[]): void {
+  reconciliations.set(channel, { expectedIds: new Set(ids) });
+}
+
+export function consumeDaemonResumeAcknowledgement(
+  channel: DaemonChannel,
+  missingIds: readonly string[],
+): DaemonResumeAcknowledgementDisposition {
+  const reconciliation = reconciliations.get(channel);
+  if (!reconciliation || missingIds.some((id) => !reconciliation.expectedIds.has(id))) {
+    return { ok: false, duplicate: false };
+  }
+  const key = JSON.stringify([...missingIds].sort());
+  if (reconciliation.acknowledgedMissingKey !== undefined) {
+    const duplicate = reconciliation.acknowledgedMissingKey === key;
+    return { ok: duplicate, duplicate };
+  }
+  reconciliation.acknowledgedMissingKey = key;
+  return { ok: true, duplicate: false };
+}
+
+export function daemonResumeAcknowledgement(
+  channel: DaemonChannel,
+  value: unknown,
+): DaemonResumeAcknowledgement | null {
+  const missingIds = daemonResumeMissingCallIds(value);
+  if (!missingIds || channel.readyState !== 1) return null;
+  const disposition = consumeDaemonResumeAcknowledgement(channel, missingIds);
+  return disposition.ok ? { missingIds, duplicate: disposition.duplicate } : null;
+}

package/src/worker/daemon-tool-redelivery.ts

@@ -0,0 +1,14 @@
+import {
+  managedJobReadArgumentsWithinExecutionBudget, managedJobReadExecutionBudgetHasHeadroom,
+} from "./managed-job-read-timeout.ts";
+
+export function daemonToolRedeliveryArguments(
+  name: string, args: Record<string, unknown>, remainingExecutionMs: number,
+): Record<string, unknown> | null {
+  if (!Number.isSafeInteger(remainingExecutionMs) || remainingExecutionMs < 1_000) return null;
+  if (name !== "read_job") return args;
+  if (managedJobReadExecutionBudgetHasHeadroom(remainingExecutionMs)) {
+    return managedJobReadArgumentsWithinExecutionBudget(args, remainingExecutionMs);
+  }
+  return { ...args, wait_ms: 0 };
+}

package/src/worker/index.ts

@@ -18,6 +18,7 @@ import { processRuntimeAlarm, scheduleRuntimeAlarm } from "./runtime-alarm.ts";
 import { consumeDaemonPreflightNonce, createDaemonChallenge, verifyDaemonAuthentication, verifyDaemonPreflight } from "./daemon-auth.ts";
 import { handleDaemonHttpRelay } from "./daemon-http-controller.ts";
 import { handleReadyDaemonMessage } from "./daemon-ready-messages.ts";
+import { beginDaemonResumeReconciliation } from "./daemon-resume-reconciliation.ts";
 import { McpController } from "./mcp-controller.ts";
 import { authorizeMcpRequest } from "./mcp-access.ts";
 import { removedProtocolResponse } from "./mcp-removed-protocol.ts";
@@ -51,11 +52,12 @@ import { MCP_DISCOVERY_TTL_MS, MCP_INSTRUCTIONS, MCP_PROTOCOL_VERSIONS,
 import { projectOverviewDetail, projectProjectOverview } from "../shared/project-overview-projection.mjs";
 import { asObject, isJsonRpcRequest, isJsonRpcResponse, rpcError } from "./mcp-jsonrpc.ts";
 import { managedJobReadArgumentsWithinExecutionBudget, managedJobReadExecutionBudgetHasHeadroom } from "./managed-job-read-timeout.ts";
+import { daemonToolRedeliveryArguments } from "./daemon-tool-redelivery.ts";
 import { hostedManagedJobDaemonArguments, projectHostedManagedJobResult } from "./managed-job-hosted-authority.ts";
 import { cancelManagedJobMonitorClaimsIfAvailable, claimManagedJobMonitor, hasManagedJobMonitorClaimIfAvailable, ManagedJobMonitorClaimStore } from "./mcp-job-monitor-claims.ts";
 import { JOB_MONITOR_CLAIM_TOOL, JOB_MONITOR_READ_TOOL, JOB_MONITOR_RENDER_TOOL, managedJobMonitorReadDaemonArguments, projectManagedJobMonitorStatus, renderManagedJobMonitor } from "./mcp-job-monitor-tools.ts";
 import { closeWebSocketQuietly, daemonErrorCloseCode, isObjectRecord, rejectDaemonMessage, sendWebSocketQuietly, trySendWebSocket } from "./websocket-protocol.ts";
-const SERVER_VERSION = "3.0.0-beta.185";
+const SERVER_VERSION = "3.0.0-beta.190";
 const MCP_SERVER_INFO = mcpServerInfo(SERVER_VERSION);
 const MAX_DAEMON_MESSAGE_BYTES = 8 * 1024 * 1024;
 const DAEMON_RECONNECT_GRACE_MS = relayContract.reconnectGraceMs; const NEW_CALL_RECONNECT_GRACE_MS = relayContract.newCallReconnectGraceMs;
@@ -332,6 +334,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       const fallbackSocket = previousSockets.find((socket) => this.daemonRegistry.readyAttachment(socket)?.instanceId === daemonInstanceId);
       const fallbackHttp = previousHttpChannels.find((channel) => this.daemonRegistry.readyAttachment(channel)?.instanceId === daemonInstanceId);
       const reboundCallIds = this.pending.rebindInstance(daemonInstanceId, ws);
+      beginDaemonResumeReconciliation(ws, reboundCallIds);
       if (reboundCallIds.length > 0) {
         this.observability.event("info", "daemon.calls.rebound", { rebound_calls: reboundCallIds.length });
       }
@@ -375,6 +378,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       beginDrain: (channel) => this.daemonRegistry.beginDrain(channel),
     });
     if (!handled.ok) {
+      this.observability.socketProtocolError(handled.errorCode ?? "unknown_message_type");
       rejectDaemonMessage(ws, handled.errorCode ?? "unknown_message_type", 1002, handled.errorMessage ?? "invalid daemon message");
       return;
     }
@@ -578,11 +582,8 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
         redeliverAfterProvenMissing: (record, channel) => {
           const remainingExecutionMs = Math.min(dispatchBudget.executionTimeoutMs,
             Math.floor(record.startedAt + dispatchBudget.executionTimeoutMs - performance.now()));
-          if (remainingExecutionMs < 1_000) return false;
-          if (name === "read_job" && !managedJobReadExecutionBudgetHasHeadroom(remainingExecutionMs)) return false;
-          const redeliveryArgs = name === "read_job"
-            ? managedJobReadArgumentsWithinExecutionBudget(args, remainingExecutionMs)
-            : args;
+          const redeliveryArgs = daemonToolRedeliveryArguments(name, args, remainingExecutionMs);
+          if (!redeliveryArgs) return false;
           return trySendDaemonChannel(channel, {
             type: "tool_call", id: record.id, tool: name, arguments: redeliveryArgs, timeout_ms: remainingExecutionMs,
             authorization: {

package/src/worker/pending-call-contract.ts

@@ -43,6 +43,7 @@ export interface PendingCallRecord {
   remainingTimeoutMs: number;
   onTimeout: (record: PendingCallRecord) => Error;
   redeliverAfterProvenMissing?: (record: PendingCallRecord, channel: DaemonChannel) => boolean;
+  provenMissingRedeliveryChannel?: DaemonChannel;
   settlement: PendingCallSettlement;
   signal?: AbortSignal;
   abortHandler?: () => void;